noahtalerman
commented
6 months ago I am not sure that the current Fleet article represents the fullest understanding of what an MDM solution CAN do in terms of preventing Activation Lock on managed devices.
@nonpunctual how do you think these docs can be improved?
the most common workflow is just for an org to ensure user's log out of iCloud
I think this is what we suggest in the docs? How could we make this clearer?
Also, is there a way to prevent an end user from logging into iCloud if their Mac isn't in ABM? Maybe via a profile?
nonpunctual
fleet-release
UPDATE: Closed this issue because it's a duplicate of the following issue:
21231
(noahtalerman)
Customer is requesting information about activation lock bypass code features in Fleet.
Activation Lock Bypass Code is a string that can be collected from an Apple supervised / managed device & escrowed to PREVENT iCloud Activation Lock if an end user logs into an iCloud account & leaves the account logged in when their device is returned to an organization's IT team.
The Bypass Code disassociates the device from the iCloud account so the org that owns it can erase it for repurposing. Without disassociating the logged-in iCloud account, a managed device logged can't be erased by the organization that owns it.
Acitvation Lock can be extremely difficult for IT depratments to manage because of the logistics & sometimes legality of contacting former employees that have left an organization. Apple's process for unlocking devices is time-consuming & only allows temporary window of resolution. Collecting & escrowing an Activation Lock Bypass Code DURING ENROLLMENT prevents Activation Lock from being an issue for organizations.
The only references to Activation Lock Bypass Code I have found in Fleet docs is here:
https://fleetdm.com/docs/using-fleet/mdm-migration-guide#activation-lock-bypass-codes
In that article there is a reference to this Apple support article:
https://support.apple.com/en-us/102541
I am not sure that the current Fleet article represents the fullest understanding of what an MDM solution CAN do in terms of preventing Activation Lock on managed devices. Typically, the code is not manually entered. It can be, but, the most common workflow is just for an org to ensure user's log out of iCloud. If there is no provision for this, iCloud becomes a major logistical problem for IT admins.